CVE-2022-26143
MiCollab, MiVoice Business Express Access Control Vulnerability
Description
CVE-2022-26143 is an unauthorized access vulnerability in Mitel MiCollab and MiVoice Business Express systems that enables attackers to leverage the TP-240 driver as a DDoS amplification vector. The flaw allows an unauthenticated attacker to send specially crafted UDP packets to the TP-240 service, which responds with massively amplified traffic directed at a target of the attacker's choosing. With an EPSS score of 76.7% (98.9th percentile), this vulnerability has been extensively exploited for DDoS amplification attacks. CISA has added CVE-2022-26143 to the Known Exploited Vulnerabilities catalog.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| mitel | micollab | < 9.4; 9.4 |
| mitel | mivoice business express | <= 8.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://arstechnica.com/information-technology/2022/03/ddosers-use-new-method-capable-of-amplifying-traffic-by-a-factor-of-4-billion/(Exploit, Press/Media Coverage, Third Party Advisory)
- https://blog.cloudflare.com/cve-2022-26143/(Mitigation, Third Party Advisory)
- https://news.ycombinator.com/item?id=30614073(Issue Tracking, Third Party Advisory)
- https://team-cymru.com/blog/2022/03/08/record-breaking-ddos-potential-discovered-cve-2022-26143/(Broken Link, Mitigation, Third Party Advisory)
- https://www.akamai.com/blog/security/phone-home-ddos-attack-vector(Mitigation, Third Party Advisory)
- https://www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-22-0001(Vendor Advisory)
- https://www.shadowserver.org/news/cve-2022-26143-tp240phonehome-reflection-amplification-ddos-attack-vector/(Mitigation, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26143(US Government Resource)
Weakness Type
CWE-284: Improper Access Control
CVE-2022-26143 results from improper access control in the TP-240 driver used by Mitel MiCollab and MiVoice Business Express. The service accepts and processes commands from unauthenticated external sources without proper authorization checks, allowing an attacker to abuse the system's test functionality to generate amplified network traffic for DDoS attacks.
Learn more: CWE-284 — Improper Access Control
Impact Analysis
CVE-2022-26143 poses a severe threat not only to the vulnerable Mitel systems themselves but to the broader internet, as it enables DDoS amplification with an amplification ratio of approximately 4.3 billion to 1. A single small UDP packet can generate a massive volume of traffic directed at a victim, making this one of the most potent DDoS amplification vectors ever discovered. The EPSS score of 76.7% (98.9th percentile) reflects the widespread abuse of this vulnerability by DDoS-for-hire services and threat actors. CISA's inclusion in the KEV catalog confirms active exploitation. The vulnerability impacts both the availability of the Mitel systems being abused and the targets of the amplified DDoS attacks.
Exploit Maturity
CVE-2022-26143 has been extensively exploited for DDoS amplification attacks since its discovery. Security researchers documented the vulnerability being actively abused to launch terabit-scale DDoS attacks. CISA confirmed exploitation by adding it to the KEV catalog. The vulnerability requires no authentication and minimal technical expertise to exploit, making it accessible to DDoS-for-hire services. The EPSS score of 76.7% (98.9th percentile) reflects the massive exploitation activity targeting exposed Mitel systems.
Remediation
- Apply Mitel security patches that address CVE-2022-26143 as recommended in Mitel's security advisory. Update MiCollab and MiVoice Business Express to the latest patched versions.
- Block external access to the TP-240 service (UDP port 10074) at the network perimeter. This service should never be accessible from the internet.
- Implement network access control lists (ACLs) to restrict TP-240 traffic to only trusted internal networks where it is required for legitimate functionality.
- Monitor for unusual outbound traffic volumes from Mitel systems, which could indicate that the system is being abused as a DDoS amplification reflector.
- Conduct an audit of all Mitel deployments to ensure that no instances have their TP-240 service exposed to the internet, and implement ongoing monitoring to detect any configuration drift.
Technical Details
CVE-2022-26143 exploits an improper access control weakness (CWE-284) in the TP-240 driver used by Mitel MiCollab and MiVoice Business Express systems. The TP-240 driver exposes a UDP service (typically on port 10074) that is intended for system testing and diagnostics. Due to insufficient access controls, this service accepts commands from any source without authentication. An attacker can send a small specially crafted UDP packet containing a test command that instructs the TP-240 driver to generate a large volume of response traffic directed at an arbitrary target IP address. The amplification ratio can reach approximately 4.3 billion to 1, meaning a single small packet can trigger gigabytes of response data. This makes it one of the most powerful DDoS amplification vectors ever discovered, capable of generating terabit-scale attacks from a small number of vulnerable systems.
Frequently Asked Questions
Is CVE-2022-26143 being actively exploited?
Yes, CVE-2022-26143 has been extensively exploited for DDoS amplification attacks. CISA confirmed active exploitation by adding it to the KEV catalog. The vulnerability has been abused by DDoS-for-hire services to launch terabit-scale attacks.
What products are affected by CVE-2022-26143?
Mitel MiCollab and MiVoice Business Express systems with the TP-240 driver are affected. Any deployment where the TP-240 service is accessible from the network is potentially vulnerable to being abused as a DDoS reflector.
How do I fix CVE-2022-26143?
Apply Mitel's security patches and immediately block external access to the TP-240 service (UDP port 10074). Ensure the service is only accessible from trusted internal networks.
How severe is CVE-2022-26143?
CVE-2022-26143 enables DDoS amplification with a ratio of approximately 4.3 billion to 1, making it one of the most potent DDoS amplification vectors ever discovered. The EPSS score of 76.7% reflects massive exploitation activity.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.